A Hacker Monster Mash

Summit: Oct 28-29 | 12 Courses: Oct 30 – Nov 4 | Hollywood, CA & Live Online

Summit Co-Chairs: Stephen Sims & Jonathan Reiter
Summit CPE Credits: 12
*This event has limited space and will sell out, register to save your spot!

Featuring Must-See Keynotes from:

David Weston | Vice President, OS Security and Enterprise, Microsoft (@dwizzzleMSFT)

Yarden Shafir | Senior Security Engineer, Trail of Bits (@yarden_shafir)

If we’ve learned anything from Tinseltown’s most iconic monster movies, it’s that danger is always right around the corner. At HackFest Hollywood, cybersecurity’s most offensive practitioners share the scary and spooky tactics used by today’s adversaries.

This two-day Summit covers all aspects of the offensive side of cybersecurity. Whether it’s penetration testing, adversary emulation, exploitation, or red teaming, there will be keynotes, workshops, CTFs, and other spooky surprises for you to sink your teeth into. Like a monster movie marathon where the monsters are cyber threats and our heroes are experts from the field equipping you with the latest in offensive knowledge.

It will be an unforgettable convergence of hacking and horror, that will leave you better equipped to protect your organization from the monsters lurking in the digital shadows.

"At SANS HackFest, you get to learn from not only the best security professionals in the industry, but also some of the best-trained instructors. As with many SANS events, HackFest is a welcoming and friendly event for any level security professional. If you can attend, do it!" - Allie Mellen

Choose Your Experience: In-Person or Live Online

Whether you're planning to dive into the full HackFest experience in Hollywood, or the free, curated content offered Live Online, you'll walk away with new tools, techniques, and connections that will have a lasting impact on your career.

In-Person: All Access Summit Experience in Hollywood

The In-Person Summit includes exclusive access to:

ALL Summit Keynotes & Talks: Two full days of highly technical content
One-of-a-Kind Networking Opportunities: You'll have the chance to engage with leading experts, SANS instructors, and your peers in the pen test community. Attendees tell us time and again that one of the greatest takeaways from SANS Summits is the many industry connections they forge or deepen during their time with us.
Hands-On Workshops and Challenges
HackFest Hollywood Nights: Join us for an exclusive evening out at Universal City Walk. You’ll have the chance to unwind and explore with your HackFest Chairs, speakers, and fellow attendees.
NEW! Offensive Ops CTF: This year will highlight the large variety of offensive skills taught across multiple courses in the Offensive Operations curriculum. Test your skills against challenges based on penetration testing, web application testing, exploitation, and more. Don’t miss your chance to win a free SANS Offensive Ops course!
SANS Offensive Operations Merchandise and Posters
FOOD! - 2-days of breakfasts, lunches, and snacks included
First-Access to Approved Recordings and Presentations

Live Online: Curated Talks Streamed from Hollywood to You

Select talks and content
HackFest Solutions Track: Leveraging AI in Cybersecurity with Matt Edmondson | Register here.
Interactive chat on Slack – connect with your pen test community
First access to recordings and presentations

As an attendee, you’ll walk away from your Summit experience with a fresh perspective, a better connection with the community and new tools that you can immediately leverage in your work.

What Attendees Say

"For me, this Summit is another valuable SANS event where every minute is worthwhile." - Moritz Schaefer

"Attending SANS HackFest Summit was an enriching experience that exceeded my expectations. The comprehensive range of expert-led sessions provided valuable insights into the latest cybersecurity trends and cutting-edge techniques." - Mahima Dharmasena

"This is an amazing opportunity to learn from the best and to network with the most encouraging people." - Amanda D.

Bundle Your Summit Experience with a SANS Offensive Operations Course

Enhance your knowledge base and add to your toolkit with a hands-on, immersive course taught by SANS Instructors — the industry's leading practitioners and course authors.

Train Your Way: In-person away from home or office distractions OR Live Online from anywhere.

Sponsorship Opportunities

Sponsorship opportunities are currently available for SANS HackFest Hollywood 2024. If your organization would be interested in sponsoring, please reach out to sponsorships@sans.org for more information.

Summit Agenda

Summit Co-Chairs: Stephen Sims & Jonathan Reiter

Summit CPE Credits: 12

Be sure to peruse the full agenda below and save any must-see talks to your calendar! Please check back frequently as the Summit agenda is subject to changes.

Time	Description
8:45 am - 9:00 am PT 3:45 pm - 4:00 pm UTC Google Calendar iCal Calendar Outlook Calendar	Opening Remarks Stephen Sims, SANS Fellow Jonathan Reiter
9:00 am - 9:45 am PT 4:00 pm - 4:45 pm UTC Google Calendar iCal Calendar Outlook Calendar	Keynote \| To be announced David Westin, Vice President, OS Security and Enterprise, Microsoft Session details to come. Show More
9:45 am - 10:00 am PT 4:45 pm - 5:00 pm UTC Google Calendar iCal Calendar Outlook Calendar	Break
10:00 am - 10:35 am PT 5:00 pm - 5:35 pm UTC Google Calendar iCal Calendar Outlook Calendar	Leveraging AI for Attack Salimah Liyakkathal, Security Researcher In this presentation, attendees will explore the darker side of Artificial Intelligence (AI) and its potential to enable sophisticated cyber threats. We will examine how AI is being leveraged in the wild, shedding light on the design and execution of advanced attacks. I will demonstrate how GenAI can be used to craft intricate attack vectors capable of disrupting critical infrastructure by causing systems to deviate from their normal behaviour. The session will delve into how AI automates the creation and optimization of these attacks, targeting the most vulnerable aspects of a system to maximize damage. Attendees will gain a deep understanding of AI-driven attack methodologies and their implications for critical infrastructure security, illustrated through OT system as a case study. Show More
10:40 am - 11:15 am PT 5:40 pm - 6:15 pm UTC Google Calendar iCal Calendar Outlook Calendar	Where's the Money: Defeating ATM Disk Encryption Matt Burch, Security Researcher Holding upwards of $400,000, ATMs continue to be a target of opportunity and have seen over a 600% increase in crime in the last few years. Over the last four years, I have conducted research with another colleague into the enterprise ATM industry which resulted in the discovery of 6 zero-day vulnerabilities in Diebold Nixdorf's Vynamic Security Suite (VSS), the most prolific ATM security solution in the market. 10 minutes or less is all that a malicious actor would need to gain full control of any system running VSS via offline code injection and enable decryption of the primary Windows OS. Diebold Nixdorf is one of three major North American enterprise class ATM manufacturers with a global presence in the financial, casino/gaming, and point-of-sale markets. Similar attack surfaces are currently being used in the wild and impact millions of systems across the globe. Furthermore, VSS is know to be present throughout the US gaming industry, including most of the ATM/cash-out systems across Vegas. This session will explore the technical intricacies of this research, review the convoluted ATM market, and reveal the discovery process of these zero-day vulnerabilities. The Full Disk Encryption module of VSS conducts a complex integrity validation process to ensure a trusted system state. Executed in a layered approach during system initialization. Examination of the inner workings of this process will highlight various deficiencies, each demonstrated through PoC exploitation. Each vulnerability presented in this session has been observed to have recursive impact across all major versions of VSS and represents a systemic ongoing risk. We will examine root-cause, vendor remediation steps, and short-comings thereof – perpetuating the attack narrative. In conclusion, proper mitigation techniques and procedures will be covered, providing valuable insights into defending against potential compromise. Show More
11:20 am - 11:55 am PT 6:20 pm - 6:55 pm UTC Google Calendar iCal Calendar Outlook Calendar	Laughing in the Face of Enterprise Security: Fun-Filled Adventures in Network Pwnage Manish Tanwar, Security Consultant, MDSec Consulting Karan Raheja, Security Engineer, Salesforce Have you ever wondered about "some esoteric techniques through which we compromised your networks". In this session, We will demonstrate some amazing “Living Off the Land” techniques, which helped us to not only evade the defenses of many Fortune 500 organizations, armed with latest security tech and robust defenses, but also helped us to achieve our objectives by exploiting the enterprise environments. Our "attack path" techniques were inspired by Lapsus$ group as well as some ransomware gang operators who made use of funny TTPs to breach the security of several organizations. We compiled a playbook containing the “living-off-the-land” techniques used by ransomware groups, added some of our own tricks to it, and used the playbook to gain control of the entire organizational network. Some of the used techniques are mentioned below: 1. Tampering with AV/EDR processes 2. Altering host firewalls(including enabling RDP) 3. Playing with EDR Telemetry 4. Luring admin into a compromised machine and stealing session token 5. Uploading offensive security tools such as rubeus, mimikatz etc. directly to compromised hosts 6. exploiting lesser known privilege escalation/persistence techniques 7. Use of HTTP Tunnelling technique, during post-exploitation phase, to reach internal/segregated environment hosts without using C2s 8. Being silent in heavily monitored environments by using "creative" techniques when web app is vulnerable to RCE (for example, avoiding usage of webshells) 9. Mixing up with events to not generate alerts configured in the windows event logs We made use of the compiled playbook in our pentests and we were surprised to know that the average success rate was in the range of 80-90% Show More
12:00 pm - 1:00 pm PT 7:00 pm - 8:00 pm UTC Google Calendar iCal Calendar Outlook Calendar	Lunch
1:00 pm - 1:35 pm PT 8:00 pm - 8:35 pm UTC Google Calendar iCal Calendar Outlook Calendar	Attacking and defending Microsoft Entra, 2024 Edition Ramiro Calderon, Principal Product Manager, Microsoft Merill Fernando, Principal Product Manager, Microsoft Attacks to Identity Providers (IdP) are constant and ever changing. Detecting and protecting against the latest threats is a must for any organization. In this session, we will cover some of the latest attacks we see against Microsoft Entra ID, formerly known as Azure Active Directory, and the best practices and defenses for detecting and preventing these attacks. You will leave with an actionable list of Go Do’s to ensure your organization is detecting and preventing these latest attacks. Show More
1:40 pm - 2:15 pm PT 8:40 pm - 9:15 pm UTC Google Calendar iCal Calendar Outlook Calendar	Redefining Security Boundaries: Unveiling Hypervisor-Backed Security Features For Windows Security Connor McGarr, Software Engineer III, Endpoint Protection (EPP), CrowdStrike For better (or for worse) it is no secret that for several years now the "latest hotness" has become so-called "Bring Your Own Vulnerable Driver (BYOVD) attacks". However, many of the blogs and proof-of-concept projects in the public domain almost always work under the assumption that kernel privileges allow unfettered access to all system resources. The truth of the matter, on the other hand, is that when properly implemented many of the tried-and-true techniques used to generate executable kernel memory, patch-out code in system-monitoring tools, arbitrarily call kernel-mode APIs, disable driver signing requirements, and many other actions are not possible with the hypervisor-based Windows security features enabled, which implement another security boundary on Windows (all of which are baked right into the Windows OS by default!). This talk will aim to: Explore the "legacy kernel exploitation scenarios" Briefly examine the underlying technologies backing many of these features, such as Second Layer Address Translation (SLAT) Dive into the NT kernel's basic interfacing mechanism with the Secure Kernel Provide brief insight into the various security features backed by the hypervisor, such as Kernel Control Flow Guard (KCFG) and Kernel Control Flow - Enforcement Technology (KCET), Kernel Data Protection, Hypervisor-Protected Code Integrity (HVCI), Secure Pool, Credential Guard, and Secure Kernel Patch Guard Show More
2:15 pm - 2:30 pm PT 9:15 pm - 9:30 pm UTC Google Calendar iCal Calendar Outlook Calendar	Break
2:30 pm - 3:05 pm PT 9:30 pm - 10:05 pm UTC Google Calendar iCal Calendar Outlook Calendar	Very Pwnable Networks: Exploiting the Top Corporate VPN Clients for Remote Root and SYSTEM Shells Richard Warren, Red Team Operator, AmberWolf David Cash, Red Team Operator, AmberWolf Have you ever been migrated to a new corporate VPN endpoint? What if you were told to connect to something that wasn't a real VPN endpoint at all? What's the worst that could happen? In this session, we show how just one click can allow an attacker to gain remote code execution and escalate privileges on both Windows and macOS. We take a look at corporate SSL-VPN clients to see what happens when you can encourage, or force, them to connect to a malicious server. We'll go through the general methodology applied to reversing the VPN protocols for some of the most widely used clients and end with everyone's favourite thing: Remote Root and SYSTEM shells. We'll be diving into how the trust relationship between the VPN client and server works, and how it can be abused to trick the client into changing settings, performing updates, and ultimately running arbitrary code in a privileged context. As these techniques use legitimate VPN functionality, they're hard to patch, but we'll give the audience mitigations that they can apply immediately if they're running one of the affected products, and practical advice that applies generally to VPN client products. The presentation will include demos of exploitation of four major VPN clients, across Windows and macOS operating systems - some of which can be triggered by simply visiting a malicious website. We'll leave you with an open-source exploit framework that automatically identifies and exploits any of the affected VPN clients that connect to it, and suggestions of how this can be utilised effectively in offensive security operations. Our talk aims to provide our audience with the following 3 takeaways: 1. Communication between a VPN client and server is worth exploring as a novel and previously underexplored attack surface and is likely to be a fruitful area for further research and investigation beyond the scope of this talk 2. VPN clients are trusting and subservient to the VPN server's instructions, and end-user builds and VPN configurations should be hardened to prevent connections to unknown VPN endpoints - this sounds relatively obvious but across the vast majority of our attack simulation engagements this has not been the case, so this talk aims to highlight the risk of this configuration and raise awareness of the possible mitigations 3. Awareness of this technique (RCE via rogue VPN servers/targeting VPN clients remotely) is currently low despite its potential for significant impact, and attendees of this presentation should feel empowered to help change this. Offensive security practitioners should be better able to introduce this type of attack into their attack simulation exercises, and defenders should be better equipped to identify, detect, and respond to these challenges as and when they happen. Show More
3:10 pm - 3:45 pm PT 10:10 pm - 10:45 pm UTC Google Calendar iCal Calendar Outlook Calendar	Silent Invaders. Revealing the Dark Web's IoT Army Antoinette Hodes, Global Solutions Architect & Evangelist, Check Point In the dynamically evolving cyber landscape, organizations need to prioritize their strategic and tactical security requirements concerning Internet of Things (IoT). With the proliferation of IoT devices, their vulnerability to cyber threats is markedly intensified, elevating them as prime targets for cybercriminals. IoT devices with their interconnected nature and vulnerabilities are attractive entry points for cybercriminals. They are highly desirable targets since they often represent a single point of vulnerability that can impact numerous victims simultaneously. IoT devices have become valuable assets in the on the dark web, as the value of a compromised device is often greater than the retail price of the device itself. Adversarial AI is amplifying risks. This paper addresses the critical vulnerabilities within IoT infrastructure, emphasizing the imperative need for a zero-tolerance security across the entire IoT supply chain. Show More
3:45 pm - 4:00 pm PT 10:45 pm - 11:00 pm UTC Google Calendar iCal Calendar Outlook Calendar	Wrap-Up

Time	Description
8:45 am - 9:00 am PT 3:45 pm - 4:00 pm UTC Google Calendar iCal Calendar Outlook Calendar	Opening Remarks Steven Sim, Head Group Cybersecurity, Maritime MNC Jonathan Reiter
9:00 am - 9:45 am PT 4:00 pm - 4:45 pm UTC Google Calendar iCal Calendar Outlook Calendar	Keynote \| Memory Safe Languages Won't Save You Yarden Shafir, Senior Security Engineer, Trail of Bits If you listen to all the experts, memory safe languages are the future of cybersecurity. But looking at the modern threat landscape, we see less memory bugs being exploited, even in code written in legacy unsafe languages. Are memory safe languages going to fix all security problems (hint: no)? Are they completely useless (hint: also no)? And what should we expect to see from threat actors going forward? Show More
9:45 am - 10:00 am PT 4:45 pm - 5:00 pm UTC Google Calendar iCal Calendar Outlook Calendar	Break
10:00 am - 10:35 am PT 5:00 pm - 5:35 pm UTC Google Calendar iCal Calendar Outlook Calendar	The call is coming from inside the house: API abuse by authenticated users Amir Sharif, Researcher, Ploof Modern cloud-based applications face significant threats from Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA). These vulnerabilities emerge from inadequately tested and undocumented APIs, which are primarily designed for frontend frameworks to manage state synchronization between client devices and application servers. Attackers exploit these vulnerabilities by reverse-engineering these APIs and manipulating data payloads. This process enables them to uncover authorization flaws, permitting them to use legitimate credentials to access privileged information from unrelated accounts. Currently, the challenge is exacerbated by AI-driven 'agents.' These programs autonomously interact with applications on users' behalf, increasing the potential for BOLA/BFLA exploitation. Participants will learn about: - Reverse-engineering frontends for BOLA/BFLA using Python and Insomnia - Examples of recently-patched electronic health record systems that exposed millions of patient records through BOLA/BFLA - AI's role in exploiting BOLA/BFLA - Mitigations, including 'fuzzing' APIs Learning objectives: 1. Participants will be able to understand the structure of Broken Object Level Authorization (BOLA)/Broken Function Level Authorization (BFLA) exploits and comprehend the potential severity of their impact on applications. 2. Participants will be able to apply methods to detect BOLA/BFLA vulnerabilities within their applications and understand how attackers may identify these vulnerabilities to exploit them. 3. Participants will be able to demonstrate strategies for monitoring and preventing BOLA/BFLA vulnerabilities in order to enhance the security posture of their applications. Show More
10:40 am - 11:15 am PT 5:40 pm - 6:15 pm UTC Google Calendar iCal Calendar Outlook Calendar	Innovative Approaches to Offensive Cybersecurity: Bridging Red and Purple Teaming Taylor Lee, CISO, Leswee LLC As the CFO and CISO of Leswee LLC, a leading management consulting firm specializing in cybersecurity, compliance, and grant writing, I bring a unique perspective to the offensive side of cybersecurity. My proposal focuses on innovative approaches to offensive cybersecurity, particularly the intersection of Red and Purple Teaming tailored for small businesses and local governments. In this session, I will discuss how our firm has successfully integrated Red and Purple Teaming strategies to enhance security postures and ensure robust threat mitigation for smaller-scale organizations. Attendees will gain insights into practical methodologies, toolsets, and case studies demonstrating effective offensive cybersecurity techniques that align with the specific needs and constraints of small businesses and local government entities. Show More
11:20 am - 11:55 am PT 6:20 pm - 6:55 pm UTC Google Calendar iCal Calendar Outlook Calendar	Living off the Security & Monitoring Tools: Windows Edition Khang Nguyen, Senior Staff Red Team Engineer, Palo Alto Networks Living-off-the-land techniques allow attackers to take advantage of on-host, or on-network utilities to achieve their objectives while blending into the environment. Hence, decreasing the chance of being detected. While more and more enterprise applications are web based now, security and monitoring tools still need to be installed on the host, and enjoy broad access to the system to gain deeper visibility. Therefore, any flaws in these applications present great opportunities for attackers to leverage for privilege escalation, persisting on the environment, collecting host information, as well as stealthy C2 communication. In this edition of the research, we will start by diving deeper into the design principles, and deployment practices of common security and monitoring software such as EDR, SIEM, and VPN on Windows. After which, we will go into which components of these software are most beneficial for us to find vulnerabilities. Then, we will explore some common vulnerabilities that can be found in these components. Lastly, we will go over some demos of vulnerabilities I found in these software and how I exploited them. Show More
12:00 pm - 1:00 pm PT 7:00 pm - 8:00 pm UTC Google Calendar iCal Calendar Outlook Calendar	Lunch
1:00 pm - 1:35 pm PT 8:00 pm - 8:35 pm UTC Google Calendar iCal Calendar Outlook Calendar	Using modern C++ in implants Jonathan Reiter Kevin Ott, Experienced Red Teamer , NVISO Security Taking over the Windows native loader by bringing it up to modern times with modern C++ programming concepts. This talk will show the attendees how to level up their implant code with modern C++ paradigms including smart pointers for memory and HANDLE management, STL functions and containers, and exception-less error handling. Show More
1:40 pm - 2:15 pm PT 8:40 pm - 9:15 pm UTC Google Calendar iCal Calendar Outlook Calendar	Breaking free from the chains of fate - Bypassing AWSCompromisedKeyQuarantineV2 Policy Bleon Proko, Cloud Security Researcher, Permiso Andrew Kraut, Senior Researcher, Permiso AWSCompromisedKeyQuarantineV2 is an AWS policy that attaches to identities whose credentials are leaked. It denies access to certain actions, applied by the AWS team in the event that an IAM user's credentials have been compromised or exposed publicly. The policy though, does not protect the infrastructure. Though many permissions are prevented, a lot more are allowed to be executed. This presentation will show how an attacker can enumerate, escalate privileges, persist and even cause mayhem in a target's environment, whose credentials have been leaked online. Show More
2:15 pm - 2:30 pm PT 9:15 pm - 9:30 pm UTC Google Calendar iCal Calendar Outlook Calendar	Break
2:30 pm - 3:05 pm PT 9:30 pm - 10:05 pm UTC Google Calendar iCal Calendar Outlook Calendar	How did they respond so fast? Jason Ostrom, SANS Certified Instructor Daryl Lim, Cofounder, Tracecat Chris Lo, Cofounders , Tracecat As red team operators, we often encounter blue teams that seem to respond with uncanny speed and precision, disrupting our carefully planned operations. This talk will pull back the curtain on one of the key tools in the blue team arsenal: automated incident response playbooks. We’ll explore how these playbooks are designed with reference to new NIST CSF 2.0 and incident response guidelines. Attendees will gain insights into how blue teams construct automated playbooks to detect, respond, and recover from three types of attacks: phishing, ransomware (endpoints), and Cloud. Through the talk, you’ll discover common strategies employed in automated playbooks such as real-time alert enrichment, deduplication, and distributed alerting. For red team operators, the talk will also show automated playbooks for adversary emulation. This will be a technical talk with practical examples shown through open source software. By the end of the talk, attendees will be able to run their own automated IR playbooks with freely available software. The overarching goal of this talk is to show red teams the theory and practice of incident response automation, so they can better anticipate defensive actions, identify potential weak points, and develop more effective attack strategies. Ultimately, benefiting the blue team’s automated defenses as well. Show More
3:10 pm - 3:45 pm PT 10:10 pm - 10:45 pm UTC Google Calendar iCal Calendar Outlook Calendar	To be announced
3:45 pm - 4:00 pm PT 10:45 pm - 11:00 pm UTC Google Calendar iCal Calendar Outlook Calendar	Wrap-Up

Advisory Board

Focus Areas

SEC504: Hacker Tools, Techniques, and Incident Handling
GCIH: GIAC Certified Incident Handler

View Syllabus

In Person

Mick Douglas

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
In Person

Live Online

Mick Douglas

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online
SEC560: Enterprise Penetration Testing
GPEN: GIAC Penetration Tester

View Syllabus

In Person

Jeff McJunkin

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
In Person

Live Online

Jeff McJunkin

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online
New

SEC565: Red Team Operations and Adversary Emulation
GRTP: GIAC Red Team Professional

View Syllabus

In Person

David Mayer

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
In Person

Live Online

David Mayer

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online
SEC542: Web App Penetration Testing and Ethical Hacking
GWAPT: GIAC Web Application Penetration Tester

View Syllabus

In Person

Timothy McKenzie

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
In Person

Live Online

Timothy McKenzie

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online
SEC588: Cloud Penetration Testing
GCPN: GIAC Cloud Penetration Tester

View Syllabus

In Person

Moses Frost

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
In Person

Live Online

Moses Frost

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online
SEC575: iOS and Android Application Security Analysis and Penetration Testing
GMOB: GIAC Mobile Device Security Analyst

View Syllabus

Live Online

Jeroen Beckers

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online
SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking
GXPN: GIAC Exploit Researcher and Advanced Penetration Tester

View Syllabus

In Person

Staff

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
In Person

Live Online

Staff

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online
SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses
GDAT: GIAC Defending Advanced Threats

View Syllabus

In Person

Michel Coene

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
In Person

Live Online

Michel Coene

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online
New

SEC598: Security Automation for Offense, Defense, and Cloud

View Syllabus

In Person

Jason Ostrom

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
In Person

Live Online

Jason Ostrom

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online
SEC617: Wireless Penetration Testing and Ethical Hacking
GAWN: GIAC Assessing and Auditing Wireless Networks

View Syllabus

Live Online

Larry Pesce

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online
SEC699: Advanced Purple Teaming - Adversary Emulation & Detection Engineering

View Syllabus

Live Online

Jean-Francois Maes

Starts 30 Oct 2024 at 8:30 AM PT (5 days)
Register for
Live Online
SEC760: Advanced Exploit Development for Penetration Testers

View Syllabus

Live Online

Jaime Geiger

Starts 30 Oct 2024 at 8:30 AM PT (6 days)
Register for
Live Online

Thank You to Our Sponsors

Important Dates

Refund Date	Hotel Group Discount Deadline
October 11, 2024	October 7, 2024

Location

Hilton Los Angeles/Universal City

555 Universal Hollywood Drive
Universal City, CA 91608

Phone: 818-506-2500

Hilton Los Angeles/Universal City

At the heart of Los Angeles' entertainment district, this hotel is adjacent to Universal Studios Hollywood, with a free shuttle to get you there. Looking on to the Hollywood Hills, the hotel is a half-mile from Universal CityWalk shopping and just as close to the local Metro station. Perks include access to the fitness center and outdoor pool.

Hotel Special Rates and Reservations

A special discounted rate of $269.00 S/D plus applicable taxes will be honored based on space availability.

This rate includes Internet in your room and is only available through Monday, October 7, 2024.

The $11.00 LA Ordinance fee is waived for SANS attendees who use the link below.

To make a reservation, please visit this link.

Top 3 reasons to stay at the Hilton Los Angeles/Universal City

No need to factor in daily cab fees and the time associated with travel to alternate hotels. Everything is in one convenient location!
By staying at the Hilton Los Angeles/Universal City, you gain the opportunity to further network with your industry peers and remain in the center of the activity surrounding the conference.
SANS schedules additional networking events at the Hilton Los Angeles/Universal City that you won't want to miss!

Travel Arrangements and Directions

A discounted self-parking rate of $10.00 per day plus applicable taxes (no in and out privileges) for attendees is available. A discounted self-parking rate of $30.00 per overnight plus applicable taxes (with in and out privileges) for attendees is available.

From Los Angeles International Airport (LAX): Approximately 25.9 miles.

Google Maps

Experience Los Angeles

3 Quick Facts about Los Angeles

In the year 1973, the Hollywood sign was turned into a landmark
One of the most iconic images of the city is the Hollywood Walk of Fame. The street is lined with over 2,600 five-point terrazzo and brass stars acting as monuments to the entertainment industry. It is estimated that over 10 million tourists visit this spot each year.
Runyon Canyon boasts one of the best hiking trails in Los Angeles with its three-mile loop and great views of the city.

SANS HackFest Hollywood 2024

A Hacker Monster Mash

Featuring Must-See Keynotes from:

Choose Your Experience: In-Person or Live Online

In-Person: All Access Summit Experience in Hollywood

Live Online: Curated Talks Streamed from Hollywood to You

What Attendees Say

Bundle Your Summit Experience with a SANS Offensive Operations Course

Sponsorship Opportunities

Summit Agenda

Opening Remarks

Keynote | To be announced

Break

Leveraging AI for Attack

Where's the Money: Defeating ATM Disk Encryption

Laughing in the Face of Enterprise Security: Fun-Filled Adventures in Network Pwnage

Lunch

Attacking and defending Microsoft Entra, 2024 Edition

Redefining Security Boundaries: Unveiling Hypervisor-Backed Security Features For Windows Security

Break

Very Pwnable Networks: Exploiting the Top Corporate VPN Clients for Remote Root and SYSTEM Shells

Silent Invaders. Revealing the Dark Web's IoT Army

Wrap-Up

Opening Remarks

Keynote | Memory Safe Languages Won't Save You

Break

The call is coming from inside the house: API abuse by authenticated users

Innovative Approaches to Offensive Cybersecurity: Bridging Red and Purple Teaming

Living off the Security & Monitoring Tools: Windows Edition

Lunch

Using modern C++ in implants

Breaking free from the chains of fate - Bypassing AWSCompromisedKeyQuarantineV2 Policy

Break

How did they respond so fast?

To be announced

Wrap-Up

Advisory Board

Summit Options